US8225389B2 - Method and system to provide physical port security in a digital communication system - Google Patents

Method and system to provide physical port security in a digital communication system Download PDF

Info

Publication number
US8225389B2
US8225389B2 US10/646,976 US64697603A US8225389B2 US 8225389 B2 US8225389 B2 US 8225389B2 US 64697603 A US64697603 A US 64697603A US 8225389 B2 US8225389 B2 US 8225389B2
Authority
US
United States
Prior art keywords
bit map
digital data
physical port
destination
port security
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active, expires
Application number
US10/646,976
Other versions
US20040205000A1 (en
Inventor
Martin Lund
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Avago Technologies International Sales Pte Ltd
Original Assignee
Broadcom Corp
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Broadcom Corp filed Critical Broadcom Corp
Priority to US10/646,976 priority Critical patent/US8225389B2/en
Assigned to BROADCOM CORPORATION reassignment BROADCOM CORPORATION ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: LUND, MARTIN
Publication of US20040205000A1 publication Critical patent/US20040205000A1/en
Application granted granted Critical
Publication of US8225389B2 publication Critical patent/US8225389B2/en
Assigned to BANK OF AMERICA, N.A., AS COLLATERAL AGENT reassignment BANK OF AMERICA, N.A., AS COLLATERAL AGENT PATENT SECURITY AGREEMENT Assignors: BROADCOM CORPORATION
Assigned to AVAGO TECHNOLOGIES GENERAL IP (SINGAPORE) PTE. LTD. reassignment AVAGO TECHNOLOGIES GENERAL IP (SINGAPORE) PTE. LTD. ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: BROADCOM CORPORATION
Assigned to BROADCOM CORPORATION reassignment BROADCOM CORPORATION TERMINATION AND RELEASE OF SECURITY INTEREST IN PATENTS Assignors: BANK OF AMERICA, N.A., AS COLLATERAL AGENT
Assigned to AVAGO TECHNOLOGIES INTERNATIONAL SALES PTE. LIMITED reassignment AVAGO TECHNOLOGIES INTERNATIONAL SALES PTE. LIMITED MERGER (SEE DOCUMENT FOR DETAILS). Assignors: AVAGO TECHNOLOGIES GENERAL IP (SINGAPORE) PTE. LTD.
Assigned to AVAGO TECHNOLOGIES INTERNATIONAL SALES PTE. LIMITED reassignment AVAGO TECHNOLOGIES INTERNATIONAL SALES PTE. LIMITED CORRECTIVE ASSIGNMENT TO CORRECT THE EFFECTIVE DATE OF MERGER TO 09/05/2018 PREVIOUSLY RECORDED AT REEL: 047230 FRAME: 0133. ASSIGNOR(S) HEREBY CONFIRMS THE MERGER. Assignors: AVAGO TECHNOLOGIES GENERAL IP (SINGAPORE) PTE. LTD.
Active legal-status Critical Current
Adjusted expiration legal-status Critical

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0236—Filtering by address, protocol, port number or service, e.g. IP-address or URL
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/08—Payment architectures
    • G06Q20/20—Point-of-sale [POS] network systems
    • G06Q20/202—Interconnection or interaction of plural electronic cash registers [ECR] or to host computer, e.g. network details, transfer of information from host to ECR or from ECR to ECR

Definitions

  • the destination addresses may be IP (Internet Protocol) addresses or MAC (media access control) addresses, for example.
  • Security is often provided by maintaining a list of allowed addresses to which frames may be forwarded.
  • a frame of data, having a destination address that is not on the list of allowed addresses, received by a device (e.g., a router) on a digital communication network can be dropped (i.e., not forwarded).
  • a device e.g., a router
  • users of a communication network can assume identities and apply methods to counter such address-based security techniques.
  • aspects of the present invention may be found in a method of providing physical port security including the steps of receiving digital data, inspecting the IP address of the data, generating a destination port bit map of requested physical ports based on the destination information contained in the data, and logically ANDing the generated map with a bit map of the allowed physical destination ports.
  • a further aspect of the method utilizes the source address information in the received data to generate the bit map of allowed physical destinations.
  • An exemplary system of the invention implements physical port security on any intermediate network device, such as a router, for example.
  • the intermediate device contains a bit map of allowed physical destinations that is logically ANDed with the bit map or truth table of requested destinations to create a table of allowed destination ports. Data is only forwarded to ports that are marked as requested AND allowed by the bit map.
  • the bit map of allowed ports may be static or dynamic. For example, the bit map of allowed ports may be generated based on the time of day.
  • FIG. 1 is a diagram illustrating an embodiment of a digital communication system providing physical port security, in accordance with various aspects of the present invention.
  • FIG. 2 is a flowchart illustrating an embodiment of a method to provide physical port security in the digital communication system of FIG. 1 , in accordance with various aspects of the present invention.
  • FIG. 3 is a diagram illustrating an embodiment of part of the method of FIG. 2 for performing a logical “AND” operation on two bit maps, in accordance with various aspects of the present invention.
  • Certain embodiments of the present invention relate to security on a digital communication network.
  • certain embodiments of the present invention relate to providing security on a digital communication system at the physical port level.
  • FIG. 1 is a diagram illustrating an embodiment of a digital communication system 100 providing physical port security, in accordance with various aspects of the present invention.
  • the digital communication system 100 comprises a source device (e.g., a PC) 101 , an intermediate network device (e.g., a network router) 102 , and nine physical ports, port # 1 103 to port # 9 111 .
  • the source device 101 interfaces to the intermediate network device 102 .
  • the intermediate network device 102 interfaces to the physical ports 103 - 111 .
  • bits of information are fit into units called data frames.
  • the data frames include source and destination information. Data frames may be classified according to their source and destination ports.
  • All nodes (clients, servers, routers, etc.) in a network are assigned an IP address that is written as four numbers between dots, such as 187.5.65.01.
  • the first part of the address is the network address and the second part is the end station address.
  • the network part of the address allows data frames to be routed to a different network.
  • IP addresses are turned into physical station addresses (i.e., MAC addresses) on a network.
  • a data frame is prefixed with an IP header that contains source and destination IP addresses for that data frame.
  • Network routers contain routing tables that move data frames to the next destination which is either the destination network or another router.
  • routers inspect only the network part of an address and direct the incoming data frames to the appropriate port for the next “hop” of the routing.
  • Routers move data frames from one hop to the next since a router typically is only aware of devices that are directly connected to the router.
  • a feature called “multicast” allows a data frame to be delivered to multiple destinations in a digital communication network.
  • a port in a communication network is a physical point at which signals may enter or leave the network in route to or from another network.
  • Router ports are physical pathways to and from a router connected via a cable.
  • the nine physical ports 103 - 111 in FIG. 1 correspond to other devices on the digital communication system 100 which may comprise end stations, other network routers, network bridges, etc.
  • the source device 101 sends a data frame to the intermediate network device 102 .
  • the intermediate network device 102 then sends the data frame to any or all of the physical ports 103 - 111 based on the destination addresses contained within the data frame and based on the physical port security defined within the intermediate network device 102 .
  • FIG. 2 is a flowchart illustrating an embodiment of a method 200 to provide physical port security in the digital communication system 100 of FIG. 1 , in accordance with various aspects of the present invention.
  • an intermediate network device receives a data frame from a source device on a communication network.
  • the intermediate network device generates a destination port bit map based on destination address information within the received data frame.
  • the intermediate network device generates a physical port security bit map based on source address information within the data frame and/or based on port security information within the intermediate network device.
  • the intermediate network device performs a logical “AND” operation on the destination port bit map and the physical port security bit map to generate a forwarding port bit map.
  • the intermediate network device forwards the data frame to allowed network destinations based on the forwarding port bit map.
  • FIG. 3 is a diagram illustrating an embodiment of part of the method 200 of FIG. 2 for performing a logical “AND” operation 300 on two bit maps, in accordance with various aspects of the present invention.
  • a physical port security bit map 301 and a destination port bit map 302 are input to the logical “AND” operation 300 .
  • the result is a forwarding port bit map 303 of allowed destinations.
  • a bit map essentially comprises a table of “1's” and “0's”.
  • a “1” indicates an allowed port and a “0” indicates a disallowed or undesired port.
  • the physical port security bit map 301 comprises a table of four “1's” and five “0's” corresponding to a total of nine physical ports that the network router 102 is connected to.
  • the four “1's” identify four physical ports (e.g., port # 1 , port # 5 , port # 6 , and port # 7 ) on the network that the network router 102 is allowed to forward frames of data to.
  • the five “0's” identify five physical ports (e.g., port # 2 , port # 3 , port # 4 , port # 8 , and port # 9 ) on the network that the router is not allowed to forward frames of data to, for security reasons.
  • the router 102 may generate a physical port security bit map based on several criteria. For example, the router may keep a pre-defined list of ports it is allowed to communicate with. Also, the router may keep a pre-defined list of source addresses and associated ports, for a given source address, it is allowed to forward data frames to. Therefore, a resultant physical port security bit map may be based on pre-defined security rules for the router and/or pre-defined security rules for a given source.
  • the physical port security bit map may also be defined dynamically. For example, the bit map may be altered or applied based on the time of day, amount of network traffic, or some other variable parameter such as source or destination port utilization or port error rates. Alternatively, the static port security map may be periodically ANDed with the dynamic map to generate the current port security bit map.
  • the network router 102 When the PC 101 sends a data frame to the network router 102 , the network router 102 generates a destination port bit map 302 .
  • the destination port bit map 302 is a translation of destination addresses to physical ports.
  • the addresses may be physical MAC addresses of network end stations and bridge ports, or logical ID's.
  • a filtering database within the network router 102 includes addresses associated with each port. The forwarding process of the network router 102 compares the destination address(es) of the received frame to the addresses in the filtering database to generate the destination port bit map 302 .
  • the destination port bit map 302 in the present example, comprises five “1's” and four “0's” corresponding to the same nine physical ports ( 103 - 111 ) on the network.
  • the five “1's” identify five physical ports (e.g., port # 1 , port # 3 , port # 5 , port # 7 , and port # 9 ) that the data frame would like to be forwarded to based on the destination addresses encoded within the data frame.
  • the logical “AND” operation 300 performed by the network router 102 results in the forwarding port bit map 303 comprising three “1's” and six “0's”. As a result, the router 102 will forward the data frame to three of the five port destinations desired by the data frame (i.e., the three port destinations identified by the three “1's” in the forwarding port bit map 303 ; port # 1 , port # 5 , and port # 7 ).
  • a source device may perform physical port security for data frames generated within the source device.
  • the source device may generate a physical port security bit map and a destination port security bit map and perform the logical “AND” operation to generate a forwarding port bit map.
  • any device on a digital communication network may perform physical port security, in accordance with various embodiments of the present invention.
  • a method and system provide physical port security on a digital communication system.
  • security rules may be defined based on associated forwarding ports and/or source devices.
  • Bit mapping techniques and logical operations may be employed to determine which ports a given data frame from a given source is allowed to be forwarded to.

Landscapes

  • Engineering & Computer Science (AREA)
  • Business, Economics & Management (AREA)
  • Accounting & Taxation (AREA)
  • General Engineering & Computer Science (AREA)
  • Strategic Management (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Finance (AREA)
  • Computing Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Business, Economics & Management (AREA)
  • General Physics & Mathematics (AREA)
  • Theoretical Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Small-Scale Networks (AREA)

Abstract

A method and system of providing physical port security in a digital data network is disclosed. The system keeps bit maps of allowed physical output ports for each physical network connection. The map of allowed ports can be different for different source addresses connected to the device. When digital data, such as an IP packet, is received, the appropriate physical port security bit map is retrieved and a logical AND is done on the physical port bit map generated by the destination information. The resulting bit map is used to determine which physical ports the data is routed to, blocking any requested destinations that are not appropriate destinations based on the port security bit map.

Description

CROSS-REFERENCE TO RELATED APPLICATIONS/INCORPORATION BY REFERENCE
This application makes reference to, claims priority to, and claims the benefit of: U.S. Provisional Application Ser. No. 60/462,172 filed Apr. 11, 2003. The above application is incorporated herein by reference in its entirety.
FEDERALLY SPONSORED RESEARCH OR DEVELOPMENT
[Not Applicable]
SEQUENCE LISTING
[Not Applicable]
MICROFICHE/COPYRIGHT REFERENCE
[Not Applicable]
BACKGROUND OF THE INVENTION
Traditional networking and switching environments rely on destination addresses within frames or packets to determine where the frame or packet is to be forwarded. The destination addresses may be IP (Internet Protocol) addresses or MAC (media access control) addresses, for example.
Security is often provided by maintaining a list of allowed addresses to which frames may be forwarded. A frame of data, having a destination address that is not on the list of allowed addresses, received by a device (e.g., a router) on a digital communication network can be dropped (i.e., not forwarded). However, users of a communication network can assume identities and apply methods to counter such address-based security techniques.
Further limitations and disadvantages of conventional and traditional approaches will become apparent to one of skill in the art, through comparison of such systems with the present invention as set forth in the remainder of the present application with reference to the drawings.
BRIEF SUMMARY OF THE INVENTION
Aspects of the present invention may be found in a method of providing physical port security including the steps of receiving digital data, inspecting the IP address of the data, generating a destination port bit map of requested physical ports based on the destination information contained in the data, and logically ANDing the generated map with a bit map of the allowed physical destination ports. A further aspect of the method utilizes the source address information in the received data to generate the bit map of allowed physical destinations. An exemplary system of the invention implements physical port security on any intermediate network device, such as a router, for example. The intermediate device contains a bit map of allowed physical destinations that is logically ANDed with the bit map or truth table of requested destinations to create a table of allowed destination ports. Data is only forwarded to ports that are marked as requested AND allowed by the bit map. The bit map of allowed ports may be static or dynamic. For example, the bit map of allowed ports may be generated based on the time of day.
These and other advantages, aspects and novel features of the present invention, as well as details of an illustrated embodiment thereof, will be more fully understood from the following description and drawings.
BRIEF DESCRIPTION OF SEVERAL VIEWS OF THE DRAWINGS
FIG. 1. is a diagram illustrating an embodiment of a digital communication system providing physical port security, in accordance with various aspects of the present invention.
FIG. 2 is a flowchart illustrating an embodiment of a method to provide physical port security in the digital communication system of FIG. 1, in accordance with various aspects of the present invention.
FIG. 3 is a diagram illustrating an embodiment of part of the method of FIG. 2 for performing a logical “AND” operation on two bit maps, in accordance with various aspects of the present invention.
 DETAILED DESCRIPTION OF THE INVENTION
Certain embodiments of the present invention relate to security on a digital communication network. In particular, certain embodiments of the present invention relate to providing security on a digital communication system at the physical port level.
FIG. 1. is a diagram illustrating an embodiment of a digital communication system 100 providing physical port security, in accordance with various aspects of the present invention. The digital communication system 100 comprises a source device (e.g., a PC) 101, an intermediate network device (e.g., a network router) 102, and nine physical ports, port # 1 103 to port # 9 111. The source device 101 interfaces to the intermediate network device 102. The intermediate network device 102 interfaces to the physical ports 103-111.
At the physical and datalink layers of a network communication protocol (e.g., the TCP/IP protocol), bits of information are fit into units called data frames. The data frames include source and destination information. Data frames may be classified according to their source and destination ports.
All nodes (clients, servers, routers, etc.) in a network (e.g., a TCP/IP-based network) are assigned an IP address that is written as four numbers between dots, such as 187.5.65.01. The first part of the address is the network address and the second part is the end station address. The network part of the address allows data frames to be routed to a different network. IP addresses are turned into physical station addresses (i.e., MAC addresses) on a network. A data frame is prefixed with an IP header that contains source and destination IP addresses for that data frame.
Network routers contain routing tables that move data frames to the next destination which is either the destination network or another router. In one embodiment, routers inspect only the network part of an address and direct the incoming data frames to the appropriate port for the next “hop” of the routing. Routers move data frames from one hop to the next since a router typically is only aware of devices that are directly connected to the router. A feature called “multicast” allows a data frame to be delivered to multiple destinations in a digital communication network.
In general, a port in a communication network is a physical point at which signals may enter or leave the network in route to or from another network. Router ports are physical pathways to and from a router connected via a cable.
The nine physical ports 103-111 in FIG. 1 correspond to other devices on the digital communication system 100 which may comprise end stations, other network routers, network bridges, etc. In accordance with an embodiment of the present invention, the source device 101 sends a data frame to the intermediate network device 102. The intermediate network device 102 then sends the data frame to any or all of the physical ports 103-111 based on the destination addresses contained within the data frame and based on the physical port security defined within the intermediate network device 102.
FIG. 2 is a flowchart illustrating an embodiment of a method 200 to provide physical port security in the digital communication system 100 of FIG. 1, in accordance with various aspects of the present invention. In step 201, an intermediate network device receives a data frame from a source device on a communication network. In step 202, the intermediate network device generates a destination port bit map based on destination address information within the received data frame. In step 203, the intermediate network device generates a physical port security bit map based on source address information within the data frame and/or based on port security information within the intermediate network device. In step 204, the intermediate network device performs a logical “AND” operation on the destination port bit map and the physical port security bit map to generate a forwarding port bit map. In step 205, the intermediate network device forwards the data frame to allowed network destinations based on the forwarding port bit map.
FIG. 3 is a diagram illustrating an embodiment of part of the method 200 of FIG. 2 for performing a logical “AND” operation 300 on two bit maps, in accordance with various aspects of the present invention. A physical port security bit map 301 and a destination port bit map 302 are input to the logical “AND” operation 300. The result is a forwarding port bit map 303 of allowed destinations.
In accordance with an embodiment of the present invention, a bit map essentially comprises a table of “1's” and “0's”. A “1” indicates an allowed port and a “0” indicates a disallowed or undesired port. As an example, referring to FIG. 1 and FIG. 3, the physical port security bit map 301 comprises a table of four “1's” and five “0's” corresponding to a total of nine physical ports that the network router 102 is connected to. The four “1's” identify four physical ports (e.g., port # 1, port # 5, port # 6, and port #7) on the network that the network router 102 is allowed to forward frames of data to. The five “0's” identify five physical ports (e.g., port # 2, port # 3, port # 4, port # 8, and port #9) on the network that the router is not allowed to forward frames of data to, for security reasons.
In accordance with various embodiments of the present invention, the router 102 may generate a physical port security bit map based on several criteria. For example, the router may keep a pre-defined list of ports it is allowed to communicate with. Also, the router may keep a pre-defined list of source addresses and associated ports, for a given source address, it is allowed to forward data frames to. Therefore, a resultant physical port security bit map may be based on pre-defined security rules for the router and/or pre-defined security rules for a given source. The physical port security bit map may also be defined dynamically. For example, the bit map may be altered or applied based on the time of day, amount of network traffic, or some other variable parameter such as source or destination port utilization or port error rates. Alternatively, the static port security map may be periodically ANDed with the dynamic map to generate the current port security bit map.
When the PC 101 sends a data frame to the network router 102, the network router 102 generates a destination port bit map 302. The destination port bit map 302 is a translation of destination addresses to physical ports. The addresses may be physical MAC addresses of network end stations and bridge ports, or logical ID's. A filtering database within the network router 102 includes addresses associated with each port. The forwarding process of the network router 102 compares the destination address(es) of the received frame to the addresses in the filtering database to generate the destination port bit map 302.
The destination port bit map 302, in the present example, comprises five “1's” and four “0's” corresponding to the same nine physical ports (103-111) on the network. The five “1's” identify five physical ports (e.g., port # 1, port # 3, port # 5, port # 7, and port #9) that the data frame would like to be forwarded to based on the destination addresses encoded within the data frame.
The logical “AND” operation 300 performed by the network router 102 results in the forwarding port bit map 303 comprising three “1's” and six “0's”. As a result, the router 102 will forward the data frame to three of the five port destinations desired by the data frame (i.e., the three port destinations identified by the three “1's” in the forwarding port bit map 303; port # 1, port # 5, and port #7). Two ports (port # 3 and port #9) of the five ports (port # 1, port # 3, port # 5, port # 7, and port #9) have been blocked from receiving the data frame for security reasons (i.e., the network router 102 will not forward the data frame to port # 3 and port # 9 even though the destination addresses in the data frame indicate that the data frame should be forwarded to port # 3 and port # 9 as well).
In accordance with an alternative embodiment of the present invention, a source device (e.g., PC 101) may perform physical port security for data frames generated within the source device. The source device may generate a physical port security bit map and a destination port security bit map and perform the logical “AND” operation to generate a forwarding port bit map. In general, any device on a digital communication network may perform physical port security, in accordance with various embodiments of the present invention.
In accordance with other alternative embodiments of the present invention, other digital communication system configurations, different from that of FIG. 1, may be implemented as well, also performing physical port security.
In summary, a method and system provide physical port security on a digital communication system. For a given device in the system, security rules may be defined based on associated forwarding ports and/or source devices. Bit mapping techniques and logical operations may be employed to determine which ports a given data frame from a given source is allowed to be forwarded to.
While the invention has been described with reference to certain embodiments, it will be understood by those skilled in the art that various changes may be made and equivalents may be substituted without departing from the scope of the invention. In addition, many modifications may be made to adapt a particular situation or material to the teachings of the invention without departing from its scope. Therefore, it is intended that the invention not be limited to the particular embodiment disclosed, but that the invention will include all embodiments falling within the scope of the appended claims.

Claims (25)

1. A method of providing physical port security in a digital communication system, comprising:
receiving a frame of digital data at a network device;
generating a destination port bit map based on the destination address information contained in said frame of digital data;
generating a physical port security bit map of allowed destination ports, wherein said physical port security bit map is generated based at least in part on information in said received frame of digital data;
comparing, using at least one logical operation, said destination port bit map with said physical port security bit map to generate a bit map of allowed destination ports; and
forwarding said frame of digital data to one or more of said allowed destination ports.
2. The method of claim 1, wherein said comparing comprises conducting a logical AND on said destination port bit map and physical port security bit map.
3. The method of claim 1, comprising generating said physical port security bit map using source address information contained in said digital data frame.
4. The method of claim 1, comprising generating said physical port security bit map using destination address information contained in said digital data frame.
5. The method of claim 1, comprising generating said physical port security bit map using a combination of source and destination address information contained in said digital data frame.
6. The method of claim 1, wherein said address information comprises IP address information.
7. The method of claim 1, wherein said frame of digital data is received by a router.
8. The method of claim 1, wherein said frame of digital data is received by a network file server.
9. The method of claim 1, wherein said network device comprises one or more physical ports connected to a local area network.
10. The method of claim 1, wherein said received frame of digital data is received from a process that is inside of said network device.
11. The method of claim 1, wherein said physical port security bit map is generated dynamically based on a variable parameter.
12. A system for providing physical port security, comprising:
at least one processor within a network device, said network device having a communications port for receiving digital data from a digital communications system and two or more physical data ports for forwarding said digital data, said at least one processor being configured to:
generate a destination port bit map based on destination address information contained in said received digital data;
generate a physical port security bit map of allowed destination ports,
wherein said physical port security bit map is generated based at least in part on information in said received frame of digital data;
compare, using at least one logical operation, said destination port bit map with said physical port security bit map to generate a bit map of allowed destination ports; and
forward said digital data to one or more of said allowed destination ports.
13. The system of claim 12, wherein said at least one processor is configured to conduct a logical AND operation on said destination port bit map and said physical port security bit map.
14. The system of claim 12, wherein said physical port security bit map is generated using source address information contained in said digital data.
15. The system of claim 12, wherein said physical port security bit map is generated using destination address information contained in said digital data.
16. The system of claim 12, wherein said physical port security bit map is generated from a table of stored allowed physical port addresses that varies depending on a combination of source and destination address information contained in said digital data.
17. The system of claim 12, wherein said address information comprises IP address information.
18. The system of claim 12, wherein said network device comprises a router.
19. The system of claim 12, wherein said network device comprises a network file server.
20. The system of claim 12, wherein said two or more physical data ports of said network device are connected to a local area network.
21. The system of claim 12, wherein said digital data comprises IP data.
22. The system of claim 12, wherein said at least one processor is configured to retrieve said physical port security bit map based on an IP source address contained in said digital data.
23. The system of claim 12, wherein said network device is the source of said received digital data.
24. The system of claim 12, wherein said physical port security bit map is dynamically altered based on a variable parameter.
25. A system for providing physical port security, comprising:
means for receiving a frame of digital data at a network device;
means for generating a destination port bit map based on the destination address information contained in said frame of digital data;
means for generating a physical port security bit map of allowed destination ports, wherein said physical port security bit map is generated based at least in part on information in said received frame of digital data;
means for comparing, using at least one logical operation, said destination port bit map with said physical port security bit map to generate a bit map of allowed destination ports; and
means for forwarding said frame of digital data to one or more of said allowed destination ports.
US10/646,976 2003-04-11 2003-08-22 Method and system to provide physical port security in a digital communication system Active 2029-05-12 US8225389B2 (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US10/646,976 US8225389B2 (en) 2003-04-11 2003-08-22 Method and system to provide physical port security in a digital communication system

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
US46217203P 2003-04-11 2003-04-11
US10/646,976 US8225389B2 (en) 2003-04-11 2003-08-22 Method and system to provide physical port security in a digital communication system

Publications (2)

Publication Number Publication Date
US20040205000A1 US20040205000A1 (en) 2004-10-14
US8225389B2 true US8225389B2 (en) 2012-07-17

Family

ID=33135255

Family Applications (1)

Application Number Title Priority Date Filing Date
US10/646,976 Active 2029-05-12 US8225389B2 (en) 2003-04-11 2003-08-22 Method and system to provide physical port security in a digital communication system

Country Status (1)

Country Link
US (1) US8225389B2 (en)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20070280239A1 (en) * 2006-05-30 2007-12-06 Martin Lund Method and system for power control based on application awareness in a packet network switch

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8705532B2 (en) * 2006-02-17 2014-04-22 Extreme Networks, Inc. Methods, systems, and computer program products for selective layer 2 port blocking using layer 2 source addresses
US7929432B2 (en) * 2007-09-24 2011-04-19 Intel Corporation Flexible starting time scheduling algorithm for bitmap coexistence protection
US20140376549A1 (en) * 2013-06-20 2014-12-25 Mediatek Inc. Packet processing apparatus and method for processing input packet according to packet processing list created based on forwarding decision made for input packet

Citations (34)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US4757529A (en) * 1986-02-28 1988-07-12 American Telephone And Telegraph Company, At&T Bell Laboratories Call distribution arrangement
US4896934A (en) * 1989-02-03 1990-01-30 Bell Communications Research, Inc. Broadband optical multicast switch
US4965467A (en) * 1988-03-21 1990-10-23 U.S. Philips Corporation Sampling system, pulse generation circuit and sampling circuit suitable for use in a sampling system, and oscilloscope equipped with a sampling system
US4991171A (en) * 1989-09-26 1991-02-05 At&T Bell Laboratories Broadcast packet switch network
US5001702A (en) * 1989-09-26 1991-03-19 At&T Bell Laboratories Packet switching network for multiple packet types
US5068892A (en) * 1989-10-31 1991-11-26 At&T Bell Laboratories Route based network management
US5457478A (en) * 1992-10-26 1995-10-10 Firstperson, Inc. Control device
US5555542A (en) * 1991-06-19 1996-09-10 Fujitsu Limited Packet directional path identifier transfer system
US5689505A (en) * 1996-01-16 1997-11-18 Lucent Technologies Inc. Buffering of multicast cells in switching networks
US5768556A (en) * 1995-12-22 1998-06-16 International Business Machines Corporation Method and apparatus for identifying dependencies within a register
US5951651A (en) * 1997-07-23 1999-09-14 Lucent Technologies Inc. Packet filter system using BITMAP vector of filter rules for routing packet through network
US6069971A (en) * 1996-12-18 2000-05-30 Mitsubishi Denki Kabushiki Kaisha Pattern comparison inspection system and method employing gray level bit map
US20020145995A1 (en) * 1998-06-15 2002-10-10 Shiro Uriu Address release method, and common buffering device for atm switching system which employs the same method
US6473431B1 (en) * 1999-07-02 2002-10-29 Sun Microsystems, Inc. System and method facilitating determination by router nodes in a network of ranges of addresses for which each router node is responsible
US6484261B1 (en) * 1998-02-17 2002-11-19 Cisco Technology, Inc. Graphical network security policy management
US6501757B1 (en) * 2000-02-29 2002-12-31 Centre For Development Of Telematics ATM switch
US6507877B1 (en) * 1999-09-03 2003-01-14 Whamtech, Inc. Asynchronous concurrent dual-stream FIFO
US20030043938A1 (en) * 2001-08-28 2003-03-06 Optix Networks Inc. Apparatus and method for periodic pattern detection
US20030128688A1 (en) * 2001-12-26 2003-07-10 Lg Electronics Inc. ATM based MPLS-LER system and method for establishing connection
US6658002B1 (en) * 1998-06-30 2003-12-02 Cisco Technology, Inc. Logical operation unit for packet processing
US20040032869A1 (en) * 2002-08-06 2004-02-19 Broadcom Corporation Packet filtering based on port bit map
US20040066781A1 (en) * 2002-10-07 2004-04-08 Broadcom Corporation Fast-path implementation for an uplink double tagging engine
US6771673B1 (en) * 2000-08-31 2004-08-03 Verizon Communications Inc. Methods and apparatus and data structures for providing access to an edge router of a network
US6792518B2 (en) * 2002-08-06 2004-09-14 Emc Corporation Data storage system having mata bit maps for indicating whether data blocks are invalid in snapshot copies
US6862279B1 (en) * 1999-06-10 2005-03-01 Fujitsu Limited Multicast distribution system of packets
US6961725B2 (en) * 2002-05-16 2005-11-01 Industrial Technology Research Institute Method of a data range search with plural pre-set rules
US7043467B1 (en) * 2000-02-08 2006-05-09 Mips Technologies, Inc. Wire-speed multi-dimensional packet classifier
US7076568B2 (en) * 1997-10-14 2006-07-11 Alacritech, Inc. Data communication apparatus for computer intelligent network interface card which transfers data between a network and a storage device according designated uniform datagram protocol socket
US7095741B1 (en) * 2000-12-20 2006-08-22 Cisco Technology, Inc. Port isolation for restricting traffic flow on layer 2 switches
US7136381B2 (en) * 2000-06-19 2006-11-14 Broadcom Corporation Memory management unit architecture for switch fabric
US7143132B2 (en) * 2002-05-31 2006-11-28 Microsoft Corporation Distributing files from a single server to multiple clients via cyclical multicasting
US7151777B2 (en) * 2002-04-04 2006-12-19 Fujitsu Limited Crosspoint switch having multicast functionality
US7193997B2 (en) * 2001-03-19 2007-03-20 International Business Machines Corporation Packet classification
US7274694B1 (en) * 2003-01-09 2007-09-25 Cisco Technology, Inc. Defining link aggregation across a stack

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP3690198B2 (en) * 1999-08-06 2005-08-31 コニカミノルタビジネステクノロジーズ株式会社 Data communication apparatus and data communication system

Patent Citations (35)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US4757529A (en) * 1986-02-28 1988-07-12 American Telephone And Telegraph Company, At&T Bell Laboratories Call distribution arrangement
US4965467A (en) * 1988-03-21 1990-10-23 U.S. Philips Corporation Sampling system, pulse generation circuit and sampling circuit suitable for use in a sampling system, and oscilloscope equipped with a sampling system
US4896934A (en) * 1989-02-03 1990-01-30 Bell Communications Research, Inc. Broadband optical multicast switch
US4991171A (en) * 1989-09-26 1991-02-05 At&T Bell Laboratories Broadcast packet switch network
US5001702A (en) * 1989-09-26 1991-03-19 At&T Bell Laboratories Packet switching network for multiple packet types
US5068892A (en) * 1989-10-31 1991-11-26 At&T Bell Laboratories Route based network management
US5555542A (en) * 1991-06-19 1996-09-10 Fujitsu Limited Packet directional path identifier transfer system
US5457478A (en) * 1992-10-26 1995-10-10 Firstperson, Inc. Control device
US5768556A (en) * 1995-12-22 1998-06-16 International Business Machines Corporation Method and apparatus for identifying dependencies within a register
US5689505A (en) * 1996-01-16 1997-11-18 Lucent Technologies Inc. Buffering of multicast cells in switching networks
US6069971A (en) * 1996-12-18 2000-05-30 Mitsubishi Denki Kabushiki Kaisha Pattern comparison inspection system and method employing gray level bit map
US5951651A (en) * 1997-07-23 1999-09-14 Lucent Technologies Inc. Packet filter system using BITMAP vector of filter rules for routing packet through network
US7076568B2 (en) * 1997-10-14 2006-07-11 Alacritech, Inc. Data communication apparatus for computer intelligent network interface card which transfers data between a network and a storage device according designated uniform datagram protocol socket
US6484261B1 (en) * 1998-02-17 2002-11-19 Cisco Technology, Inc. Graphical network security policy management
US20020145995A1 (en) * 1998-06-15 2002-10-10 Shiro Uriu Address release method, and common buffering device for atm switching system which employs the same method
US6658002B1 (en) * 1998-06-30 2003-12-02 Cisco Technology, Inc. Logical operation unit for packet processing
US6862279B1 (en) * 1999-06-10 2005-03-01 Fujitsu Limited Multicast distribution system of packets
US6473431B1 (en) * 1999-07-02 2002-10-29 Sun Microsystems, Inc. System and method facilitating determination by router nodes in a network of ranges of addresses for which each router node is responsible
US6507877B1 (en) * 1999-09-03 2003-01-14 Whamtech, Inc. Asynchronous concurrent dual-stream FIFO
US7043467B1 (en) * 2000-02-08 2006-05-09 Mips Technologies, Inc. Wire-speed multi-dimensional packet classifier
US6501757B1 (en) * 2000-02-29 2002-12-31 Centre For Development Of Telematics ATM switch
US7136381B2 (en) * 2000-06-19 2006-11-14 Broadcom Corporation Memory management unit architecture for switch fabric
US6771673B1 (en) * 2000-08-31 2004-08-03 Verizon Communications Inc. Methods and apparatus and data structures for providing access to an edge router of a network
US7881296B2 (en) * 2000-12-20 2011-02-01 Cisco Technology, Inc. Port isolation for restricting traffic flow on layer 2 switches
US7095741B1 (en) * 2000-12-20 2006-08-22 Cisco Technology, Inc. Port isolation for restricting traffic flow on layer 2 switches
US7193997B2 (en) * 2001-03-19 2007-03-20 International Business Machines Corporation Packet classification
US20030043938A1 (en) * 2001-08-28 2003-03-06 Optix Networks Inc. Apparatus and method for periodic pattern detection
US20030128688A1 (en) * 2001-12-26 2003-07-10 Lg Electronics Inc. ATM based MPLS-LER system and method for establishing connection
US7151777B2 (en) * 2002-04-04 2006-12-19 Fujitsu Limited Crosspoint switch having multicast functionality
US6961725B2 (en) * 2002-05-16 2005-11-01 Industrial Technology Research Institute Method of a data range search with plural pre-set rules
US7143132B2 (en) * 2002-05-31 2006-11-28 Microsoft Corporation Distributing files from a single server to multiple clients via cyclical multicasting
US6792518B2 (en) * 2002-08-06 2004-09-14 Emc Corporation Data storage system having mata bit maps for indicating whether data blocks are invalid in snapshot copies
US20040032869A1 (en) * 2002-08-06 2004-02-19 Broadcom Corporation Packet filtering based on port bit map
US20040066781A1 (en) * 2002-10-07 2004-04-08 Broadcom Corporation Fast-path implementation for an uplink double tagging engine
US7274694B1 (en) * 2003-01-09 2007-09-25 Cisco Technology, Inc. Defining link aggregation across a stack

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20070280239A1 (en) * 2006-05-30 2007-12-06 Martin Lund Method and system for power control based on application awareness in a packet network switch
US8437352B2 (en) * 2006-05-30 2013-05-07 Broadcom Corporation Method and system for power control based on application awareness in a packet network switch

Also Published As

Publication number Publication date
US20040205000A1 (en) 2004-10-14

Similar Documents

Publication Publication Date Title
US20220078037A1 (en) Service insertion for multicast traffic at boundary
US8730967B1 (en) Policy-based virtual routing and forwarding (VRF) assignment
US6570875B1 (en) Automatic filtering and creation of virtual LANs among a plurality of switch ports
US7292573B2 (en) Methods and apparatus for selection of mirrored traffic
JP4076586B2 (en) Systems and methods for multilayer network elements
US7680943B2 (en) Methods and apparatus for implementing multiple types of network tunneling in a uniform manner
US8094660B2 (en) VLAN server
US7039018B2 (en) Technique to improve network routing using best-match and exact-match techniques
US7940766B2 (en) Multicasting unicast packet/multiple classification of a packet
EP1408655B1 (en) Method and device for double tagging of data packets
US6553028B1 (en) Method and apparatus for multicast switching using a centralized switching engine
US8301882B2 (en) Method and apparatus for ingress filtering using security group information
US20070201490A1 (en) System and method for implementing ethernet MAC address translation
US7826481B2 (en) Network for supporting advance features on legacy components
US7613120B2 (en) Dynamic wide area network packet routing
US7864788B2 (en) System and method for bridging proxy traffic in an electronic network
US20040105440A1 (en) Packet-switched network and network switches having a network layer forwarding action performed by data link switching
US6751220B1 (en) Apparatus and method of managing virtual private network routing data
US6556575B1 (en) Broadcast traffic reduction in a communications network
US7433963B2 (en) Methods, systems, and computer program products for using a translation/instruction system to redirect a multiprotocol label switching (MPLS) packet
US6950429B2 (en) IP data transmission network using a route selection based on level 4/5 protocol information
US8225389B2 (en) Method and system to provide physical port security in a digital communication system
Cisco Configuring CEF for PFC2
Cisco Configuring CEF for PFC2
Cisco Configuring CEF for PFC2

Legal Events

Date Code Title Description
AS Assignment

Owner name: BROADCOM CORPORATION, CALIFORNIA

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:LUND, MARTIN;REEL/FRAME:014429/0839

Effective date: 20030820

STCF Information on status: patent grant

Free format text: PATENTED CASE

FPAY Fee payment

Year of fee payment: 4

SULP Surcharge for late payment
AS Assignment

Owner name: BANK OF AMERICA, N.A., AS COLLATERAL AGENT, NORTH CAROLINA

Free format text: PATENT SECURITY AGREEMENT;ASSIGNOR:BROADCOM CORPORATION;REEL/FRAME:037806/0001

Effective date: 20160201

Owner name: BANK OF AMERICA, N.A., AS COLLATERAL AGENT, NORTH

Free format text: PATENT SECURITY AGREEMENT;ASSIGNOR:BROADCOM CORPORATION;REEL/FRAME:037806/0001

Effective date: 20160201

AS Assignment

Owner name: AVAGO TECHNOLOGIES GENERAL IP (SINGAPORE) PTE. LTD., SINGAPORE

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:BROADCOM CORPORATION;REEL/FRAME:041706/0001

Effective date: 20170120

Owner name: AVAGO TECHNOLOGIES GENERAL IP (SINGAPORE) PTE. LTD

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:BROADCOM CORPORATION;REEL/FRAME:041706/0001

Effective date: 20170120

AS Assignment

Owner name: BROADCOM CORPORATION, CALIFORNIA

Free format text: TERMINATION AND RELEASE OF SECURITY INTEREST IN PATENTS;ASSIGNOR:BANK OF AMERICA, N.A., AS COLLATERAL AGENT;REEL/FRAME:041712/0001

Effective date: 20170119

AS Assignment

Owner name: AVAGO TECHNOLOGIES INTERNATIONAL SALES PTE. LIMITE

Free format text: MERGER;ASSIGNOR:AVAGO TECHNOLOGIES GENERAL IP (SINGAPORE) PTE. LTD.;REEL/FRAME:047230/0133

Effective date: 20180509

AS Assignment

Owner name: AVAGO TECHNOLOGIES INTERNATIONAL SALES PTE. LIMITE

Free format text: CORRECTIVE ASSIGNMENT TO CORRECT THE EFFECTIVE DATE OF MERGER TO 09/05/2018 PREVIOUSLY RECORDED AT REEL: 047230 FRAME: 0133. ASSIGNOR(S) HEREBY CONFIRMS THE MERGER;ASSIGNOR:AVAGO TECHNOLOGIES GENERAL IP (SINGAPORE) PTE. LTD.;REEL/FRAME:047630/0456

Effective date: 20180905

MAFP Maintenance fee payment

Free format text: PAYMENT OF MAINTENANCE FEE, 8TH YEAR, LARGE ENTITY (ORIGINAL EVENT CODE: M1552); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY

Year of fee payment: 8

MAFP Maintenance fee payment

Free format text: PAYMENT OF MAINTENANCE FEE, 12TH YEAR, LARGE ENTITY (ORIGINAL EVENT CODE: M1553); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY

Year of fee payment: 12